user www;
worker_processes 4;
timer_resolution 100ms;
worker_rlimit_nofile 8192;
worker_priority -5;
error_log /var/log/www/nginx-error.log;
error_log /var/log/www/nginx-error-notice.log notice;
error_log /var/log/www/nginx-error-info.log info;
pid /var/run/nginx.pid;
events {
worker_connections 2048;
use kqueue;
}
http {
include mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] '
'"$request" $status $bytes_sent '
'"$http_referer" "$http_user_agent" '
'"$gzip_ratio"';
access_log /var/log/www/nginx-access.log main;
sendfile on;
client_max_body_size 128M;
keepalive_timeout 165;
tcp_nopush on;
tcp_nodelay on;
server_tokens off;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
proxy_redirect off;
proxy_pass_header Set-Cookie;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_connect_timeout 90;
proxy_send_timeout 90;
proxy_read_timeout 90;
proxy_buffer_size 16k;
proxy_buffers 32 16k;
proxy_busy_buffers_size 64k;
proxy_temp_file_write_size 64k;
server_names_hash_max_size 256;
server_names_hash_bucket_size 128;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 5m;
ssl_prefer_server_ciphers on;
client_body_buffer_size 128k;
client_header_buffer_size 64k;
gzip on;
gzip_disable "msie6";
gzip_vary on;
gzip_proxied any;
gzip_comp_level 9;
gzip_min_length 1100;
gzip_buffers 64 8k;
gzip_http_version 1.1;
gzip_types text/plain text/css text/xml application/json application/javascript application/xml+rss application/atom+xml image/svg+xml;
gzip_disable "MSIE [1-6].(?!.*SV1)";
include /usr/local/etc/nginx/conf/*.conf;
}server {
listen 80 default_server;
server_name 192.168.0.111 www.192.168.0.111;
access_log /var/log/www/192.168.0.111-access-nginx.log;
error_log /var/log/www/192.168.0.111-error-nginx.log;
root /web/sites;
client_max_body_size 2048m;
rewrite ^ https://192.168.0.111$request_uri? permanent; #301-redirect
}
server {
include /usr/local/etc/nginx/mime.types;
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
ssl_certificate /usr/local/etc/nginx/ssl/_server_/server.crt;
ssl_certificate_key /usr/local/etc/nginx/ssl/_server_/server.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "HIGH:!RC4:!aNULL:!MD5:!kEDH";
add_header Strict-Transport-Security 'max-age=604800';
server_name 192.168.0.111 www.192.168.0.111;
access_log /var/log/www/192.168.0.111-access-nginx.log;
error_log /var/log/www/192.168.0.111-error-nginx.log;
root /web/sites/;
error_page 404 /404.html;
location /404.html { break; }
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/local/www/nginx-dist;
}
location ~* {
auth_basic "Admin";
auth_basic_user_file /web/sites/.htpasswd;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /web/sites$fastcgi_script_name;
include fastcgi_params;
}
index index.php;
location ~* \.(jpg|jpeg|gif|png|css|zip|tgz|gz|rar|bz2|doc|xls|exe|pdf|ppt|tar|wav|bmp|rtf|swf|ico|flv|txt|xml|docx|xlsx)$ {
access_log off;
expires 30d;
}
location ~ ^/base/ {
root /usr/local/www/phpMyAdmin/;
index index.php index.html index.htm;
}
location /mail {
# alias /usr/local/www/roundcube/;
root /usr/local/www/roundcube/;
index index.php index.html index.htm;
}
location ~ \.php$ {
fastcgi_param HTTPS on; # Для php-fpm
try_files $uri $uri/ /index.php?$args;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_script_name;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout 180;
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
}root@localhost:/ # nginx -t
nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok
nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successfulhttp {
include mime.types;
default_type: application/octet-stream
}